ATLANTA — Visa and MasterCard are using security measures prone to fraud, putting retailers and customers at risk of thieves, The Home Depot Inc. says in a new federal lawsuit.
It’s the latest large retailer to raise the security concerns, with a lawsuit filed this week in U.S. District Court in Atlanta. Last month, Wal-Mart Stores Inc. sued Visa Inc. over similar issues.
Atlanta-based Home Depot says new payment cards with “chip” technology remain less secure in the U.S. used elsewhere.
Even with chips, U.S. cards still rely on customers’ signatures for verification, rather than secure Personal Identification Numbers, or PINs, Home Depot maintains.
“Regardless of how the cardholder’s identity is confirmed, the chip makes data much more secure, rendering it almost useless to create fraudulent cards or transactions,” MasterCard spokesman Seth Eisen said in a statement Wednesday.
MasterCard received the court filing Tuesday and is still reviewing it, Eisen said.
A central issue in Home Depot’s lawsuit: Its accusation that Visa and MasterCard are conspiring to prevent adoption of more secure technology in order to maintain market dominance and profits.
“For years, Visa and MasterCard have been more concerned with protecting their own inflated profits and their dominant market positions than with the security of payment cards used by American consumers and the health of the United States economy,” Home Depot states in its lawsuit.
About 80 nations use cards with chips, and most of them also require a PIN, Home Depot said.
“Such cards offer an extra layer of security beyond the chip itself, by requiring the user to enter a four-digit PIN, thereby ensuring that the individual using the card is the card’s owner,” Home Depot states. “Signatures can be copied or forged, and cashiers are not handwriting experts trained to identify forged signatures.”
As a result, U.S. consumers and merchants such as Home Depot pay fraud-related costs “unrivaled in the rest of the industrial world.”
A chip in combination with a PIN is a form of “two-factor authentication,” said Craig Piercy, director of the master of internet technology program at the University of Georgia’s Terry College of Business.
If a card is stolen, even one with a microchip, a thief could still use it by inserting it into the card reader, then scribbling the name on the card on a receipt or pad near a cash register. But if the thief doesn’t know the PIN, the card is rejected.
“Neither one protects against all types of fraud, but in terms of protecting against lost or stolen cards, chip and PIN is more secure,” Piercy said.
